tests/tests/webkitsecurity/assets/use-crash-using-children-before-destroy.svg

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
    <text>PASS if no crash/assert</text>
    <g id="outer"><use id="a"></use></g>
    <use id="b" xlink:href="#outer" />
<script><![CDATA[
var useobj = document.getElementById("b").instanceRoot;

function test() {
    var elem = document.getElementById("b");
    elem.parentNode.removeChild(elem);
}
test();

document.getElementById("a").appendChild(document.createElement("g"));

if (window.layoutTestController) {
    layoutTestController.dumpAsText();
}
]]></script>
</svg>